@proveanything/smartlinks 1.16.5 → 1.16.7

package/dist/api/attestations.d.ts

@@ -1,4 +1,4 @@
-import type { Attestation, CreateAttestationInput, ListAttestationsParams, ListAttestationsResponse, AttestationSummaryParams, AttestationSummaryResponse, PublicAttestationSummaryResponse, AttestationLatestParams, AttestationLatestResponse, PublicAttestationLatestResponse, AttestationVerifyParams, ChainVerifyResult, AttestationTreeSummaryParams, AttestationTreeSummaryResponse, PublicAttestationTreeSummaryResponse, AttestationTreeLatestParams, AttestationTreeLatestResponse, PublicAttestationTreeLatestResponse, PublicListAttestationsResponse } from "../types/attestations";
+import type { Attestation, CreateAttestationInput, ListAttestationsParams, ListAttestationsResponse, AttestationSummaryParams, AttestationSummaryResponse, PublicAttestationSummaryResponse, AttestationLatestParams, AttestationLatestResponse, PublicAttestationLatestResponse, AttestationVerifyParams, ChainVerifyResult, AttestationTreeSummaryParams, AttestationTreeSummaryResponse, PublicAttestationTreeSummaryResponse, AttestationTreeLatestParams, AttestationTreeLatestResponse, PublicAttestationTreeLatestResponse, PublicListAttestationsResponse, OwnerAttestationInput, CreateOwnerAttestationResponse, ModerateAttestationInput, ModerateAttestationResponse } from "../types/attestations";
 /**
  * Postgres-backed Attestations API (v2).
  *
@@ -10,9 +10,14 @@ import type { Attestation, CreateAttestationInput, ListAttestationsParams, ListA
  *
  * ### Admin vs Public
  * - **Admin** endpoints (`/admin/collection/:id/attestations`) require a valid
- *   admin session or bearer token.  All three data zones are returned.
- * - **Public** endpoints (`/public/collection/:id/attestations`) are read-only.
- *   Owner elevation is available via `Authorization: Bearer <Firebase ID token>`.
+ *   admin session or bearer token.  All three data zones are returned, and the
+ *   business can write any zone/visibility ({@link create}).
+ * - **Public** endpoints (`/public/collection/:id/attestations`) are read-only,
+ *   EXCEPT {@link publicCreate} (the proof OWNER, or a `contribute`-grant holder,
+ *   authors an attestation — value + ownerData, visibility public|owner, never the
+ *   admin zone) and {@link moderate} (owner/admin approves or rejects a contributed
+ *   record). Owner elevation is via `Authorization: Bearer <Firebase ID token>`;
+ *   contributor access via a grant token set with `setGrantToken`.
  *
  * @see docs/attestations.md
  */
@@ -207,6 +212,50 @@ export declare namespace attestations {
      * ```
      */
     function publicList(collectionId: string, params: ListAttestationsParams): Promise<PublicListAttestationsResponse>;
+    /**
+     * Create a public attestation — the counterpart to the admin {@link create}.
+     * Authorised two ways, same call (the server decides from the request):
+     *   1. the proof OWNER (identity, via `Authorization: Bearer <Firebase ID token>`)
+     *      adds an attestation to their own item; or
+     *   2. a holder of a `contribute`-scope grant adds one — call
+     *      {@link setGrantToken} with the grant token first; for a public-link
+     *      (anonymous) grant, pass `guestName` for attribution.
+     *
+     * Guardrails (server-enforced): `value` + `ownerData` only (`adminData` dropped),
+     * `visibility` clamped to `'public' | 'owner'`, `authorId`/`grantId` server-stamped.
+     * If the contribute grant was issued with `moderate: true`, the returned record
+     * has `moderationStatus: 'pending'` — held to the owner until {@link moderate}.
+     * The record joins the same tamper-evident hash chain.
+     * POST /public/collection/:collectionId/attestations
+     * ```ts
+     * // Owner:
+     * await attestations.publicCreate('coll_123', {
+     *   subjectType: 'proof', subjectId: 'proof_1',
+     *   attestationType: 'condition-report',
+     *   value: { grade: 'excellent' }, visibility: 'public',
+     * })
+     * // Contributor on a shared link:
+     * setGrantToken(shareToken)
+     * await attestations.publicCreate('coll_123', {
+     *   subjectType: 'proof', subjectId: 'proof_1',
+     *   attestationType: 'photo', value: { url }, visibility: 'public',
+     *   guestName: 'Sam',
+     * })
+     * ```
+     */
+    function publicCreate(collectionId: string, data: OwnerAttestationInput): Promise<CreateOwnerAttestationResponse>;
+    /**
+     * Moderate a contributed attestation (proof OWNER by identity, or collection
+     * admin). `'approve'` releases it to its declared visibility; `'reject'` keeps
+     * it author + admin only. Only the `moderationStatus` changes — the hashed fact
+     * and its chain are untouched. Find pending items with
+     * {@link publicList} + `moderationStatus: 'pending'`.
+     * POST /public/collection/:collectionId/attestations/:attestationId/moderate
+     * ```ts
+     * await attestations.moderate('coll_123', 'att_uuid', { decision: 'approve' })
+     * ```
+     */
+    function moderate(collectionId: string, attestationId: string, input: ModerateAttestationInput): Promise<ModerateAttestationResponse>;
     /**
      * Time-series summary (public).
      *

package/dist/api/attestations.js

@@ -23,9 +23,14 @@ function buildAttestationQuery(params) {
  *
  * ### Admin vs Public
  * - **Admin** endpoints (`/admin/collection/:id/attestations`) require a valid
- *   admin session or bearer token.  All three data zones are returned.
- * - **Public** endpoints (`/public/collection/:id/attestations`) are read-only.
- *   Owner elevation is available via `Authorization: Bearer <Firebase ID token>`.
+ *   admin session or bearer token.  All three data zones are returned, and the
+ *   business can write any zone/visibility ({@link create}).
+ * - **Public** endpoints (`/public/collection/:id/attestations`) are read-only,
+ *   EXCEPT {@link publicCreate} (the proof OWNER, or a `contribute`-grant holder,
+ *   authors an attestation — value + ownerData, visibility public|owner, never the
+ *   admin zone) and {@link moderate} (owner/admin approves or rejects a contributed
+ *   record). Owner elevation is via `Authorization: Bearer <Firebase ID token>`;
+ *   contributor access via a grant token set with `setGrantToken`.
  *
  * @see docs/attestations.md
  */
@@ -273,6 +278,58 @@ export var attestations;
         return request(path);
     }
     attestations.publicList = publicList;
+    /**
+     * Create a public attestation — the counterpart to the admin {@link create}.
+     * Authorised two ways, same call (the server decides from the request):
+     *   1. the proof OWNER (identity, via `Authorization: Bearer <Firebase ID token>`)
+     *      adds an attestation to their own item; or
+     *   2. a holder of a `contribute`-scope grant adds one — call
+     *      {@link setGrantToken} with the grant token first; for a public-link
+     *      (anonymous) grant, pass `guestName` for attribution.
+     *
+     * Guardrails (server-enforced): `value` + `ownerData` only (`adminData` dropped),
+     * `visibility` clamped to `'public' | 'owner'`, `authorId`/`grantId` server-stamped.
+     * If the contribute grant was issued with `moderate: true`, the returned record
+     * has `moderationStatus: 'pending'` — held to the owner until {@link moderate}.
+     * The record joins the same tamper-evident hash chain.
+     * POST /public/collection/:collectionId/attestations
+     * ```ts
+     * // Owner:
+     * await attestations.publicCreate('coll_123', {
+     *   subjectType: 'proof', subjectId: 'proof_1',
+     *   attestationType: 'condition-report',
+     *   value: { grade: 'excellent' }, visibility: 'public',
+     * })
+     * // Contributor on a shared link:
+     * setGrantToken(shareToken)
+     * await attestations.publicCreate('coll_123', {
+     *   subjectType: 'proof', subjectId: 'proof_1',
+     *   attestationType: 'photo', value: { url }, visibility: 'public',
+     *   guestName: 'Sam',
+     * })
+     * ```
+     */
+    async function publicCreate(collectionId, data) {
+        const path = `/public/collection/${encodeURIComponent(collectionId)}/attestations`;
+        return post(path, data);
+    }
+    attestations.publicCreate = publicCreate;
+    /**
+     * Moderate a contributed attestation (proof OWNER by identity, or collection
+     * admin). `'approve'` releases it to its declared visibility; `'reject'` keeps
+     * it author + admin only. Only the `moderationStatus` changes — the hashed fact
+     * and its chain are untouched. Find pending items with
+     * {@link publicList} + `moderationStatus: 'pending'`.
+     * POST /public/collection/:collectionId/attestations/:attestationId/moderate
+     * ```ts
+     * await attestations.moderate('coll_123', 'att_uuid', { decision: 'approve' })
+     * ```
+     */
+    async function moderate(collectionId, attestationId, input) {
+        const path = `/public/collection/${encodeURIComponent(collectionId)}/attestations/${encodeURIComponent(attestationId)}/moderate`;
+        return post(path, input);
+    }
+    attestations.moderate = moderate;
     /**
      * Time-series summary (public).
      *

package/dist/api/proof.js

@@ -222,6 +222,9 @@ export var proof;
             body.audience = options.audience;
         if (options.expiresAt)
             body.expiresAt = options.expiresAt instanceof Date ? options.expiresAt.toISOString() : options.expiresAt;
+        // Only applied server-side when scope includes 'contribute'.
+        if (options.moderate !== undefined)
+            body.moderate = options.moderate;
         return post(grantBase(collectionId, productId, proofId), body);
     }
     proof.createGrant = createGrant;

package/dist/docs/API_SUMMARY.md

@@ -1,6 +1,6 @@
 # Smartlinks API Summary
 
-Version: 1.16.5  |  Generated: 2026-09-05T15:46:49.017Z
+Version: 1.16.7  |  Generated: 2026-09-09T11:29:21.917Z
 
 This is a concise summary of all available API functions and types.
 
@@ -2745,6 +2745,15 @@ interface Attestation {
   unit?: string
   source?: string
   authorId?: string
+  * When authored under a `contribute` grant (rather than by identity), the id of
+  * the granting token — provenance for a contributed record. `null`/absent for
+  * owner/admin/identity writes.
+  grantId?: string | null
+  * Moderation gate, orthogonal to {@link visibility} and excluded from the hash
+  * chain. `'approved'` (default) is live; `'pending'` is held for owner review
+  * (visible only to its author and owner/admin audiences); `'rejected'` was
+  * declined. Contributions under a `moderate` grant start `'pending'`.
+  moderationStatus?: AttestationModerationStatus
   metadata?: Record<string, any>
   contentHash: string
   prevHash?: string
@@ -2797,6 +2806,39 @@ interface CreateAttestationInput {
 }
 ```
 
+**OwnerAttestationInput** (interface)
+```typescript
+interface OwnerAttestationInput {
+  subjectType: AttestationSubjectType
+  subjectId: string
+  attestationType: string
+  recordedAt?: string
+  visibility?: 'public' | 'owner'
+  value?: Record<string, any>
+  ownerData?: Record<string, any>
+  unit?: string
+  source?: string
+  metadata?: Record<string, any>
+  * Attribution for an anonymous (public-link) contribute-grant write. Ignored
+  * for owner writes and for named-grant writes (attributed to the signed-in uid).
+  guestName?: string
+}
+```
+
+**ModerateAttestationInput** (interface)
+```typescript
+interface ModerateAttestationInput {
+  decision: 'approve' | 'reject'
+}
+```
+
+**ModerateAttestationResponse** (interface)
+```typescript
+interface ModerateAttestationResponse {
+  attestation: Attestation
+}
+```
+
 **ListAttestationsResponse** (interface)
 ```typescript
 interface ListAttestationsResponse {
@@ -2804,6 +2846,13 @@ interface ListAttestationsResponse {
 }
 ```
 
+**CreateOwnerAttestationResponse** (interface)
+```typescript
+interface CreateOwnerAttestationResponse {
+  attestation: Attestation
+}
+```
+
 **PublicListAttestationsResponse** (interface)
 ```typescript
 interface PublicListAttestationsResponse {
@@ -2882,6 +2931,10 @@ interface ListAttestationsParams {
   subjectType: AttestationSubjectType
   subjectId: string
   attestationType?: string
+  * Filter by moderation state. Primarily for the owner review queue
+  * (`moderationStatus: 'pending'`). ANDs with the server's audience gate, so a
+  * public caller can never use it to widen access.
+  moderationStatus?: AttestationModerationStatus
   recordedAfter?: string
   recordedBefore?: string
   limit?: number
@@ -2946,6 +2999,8 @@ interface AttestationTreeLatestParams {
 
 **AttestationVisibility** = `'public' | 'owner' | 'admin'`
 
+**AttestationModerationStatus** = `'approved' | 'pending' | 'rejected'`
+
 **AttestationAudience** = `'public' | 'owner' | 'admin'`
 
 **AttestationGroupBy** = `'hour' | 'day' | 'week' | 'month'`
@@ -7541,6 +7596,9 @@ interface ProofGrant {
   proofId: string
   productId?: string | null
   scope: GrantScope[]
+  * `contribute` grants only: when true, records/attestations added under this
+  * grant land `pending` (owner-only) until the owner approves them.
+  moderate?: boolean
   audience: GrantAudience
   createdBy: string
   expiresAt?: string | null
@@ -7559,6 +7617,11 @@ interface CreateGrantOptions {
   scope: GrantScope[]
   audience?: GrantAudience
   expiresAt?: Date | string
+  * Only meaningful with the `contribute` scope: hold contributions made under
+  * this grant for owner review (they start `pending` and are owner-only until
+  * approved). Ignored for other scopes. Defaults to `false` (contributions live
+  * on write).
+  moderate?: boolean
 }
 ```
 
@@ -7656,7 +7719,7 @@ interface CancelTransferOptions {
 
 **ProofFieldDef** = `ScopedFieldDef & { scope?: ProofFieldScope }`
 
-**GrantScope** = `'read' | 'comment' | 'admin' | 'verify_owner'`
+**GrantScope** = `'read' | 'comment' | 'contribute' | 'admin' | 'verify_owner'`
 
 **RedeemGrantResult** = ``
 
@@ -9063,6 +9126,15 @@ Tree latest snapshot — most-recent record per type across a container subtree
     params: ListAttestationsParams) → `Promise<PublicListAttestationsResponse>`
 List attestations for a subject (public). Records with `visibility='admin'` are always excluded. Records with `visibility='owner'` are included only when the caller provides a valid Firebase ID token that resolves to the subject owner. The `audience` field in the response indicates the tier that was served. ```typescript const { attestations: records, audience } = await attestations.publicList('coll_123', { subjectType: 'proof', subjectId:   'proof-uuid', }) ```
 
+**publicCreate**(collectionId: string,
+    data: OwnerAttestationInput) → `Promise<CreateOwnerAttestationResponse>`
+Create a public attestation — the counterpart to the admin {@link create}. Authorised two ways, same call (the server decides from the request): 1. the proof OWNER (identity, via `Authorization: Bearer <Firebase ID token>`) adds an attestation to their own item; or 2. a holder of a `contribute`-scope grant adds one — call {@link setGrantToken} with the grant token first; for a public-link (anonymous) grant, pass `guestName` for attribution. Guardrails (server-enforced): `value` + `ownerData` only (`adminData` dropped), `visibility` clamped to `'public' | 'owner'`, `authorId`/`grantId` server-stamped. If the contribute grant was issued with `moderate: true`, the returned record has `moderationStatus: 'pending'` — held to the owner until {@link moderate}. The record joins the same tamper-evident hash chain. POST /public/collection/:collectionId/attestations ```ts // Owner: await attestations.publicCreate('coll_123', { subjectType: 'proof', subjectId: 'proof_1', attestationType: 'condition-report', value: { grade: 'excellent' }, visibility: 'public', }) // Contributor on a shared link: setGrantToken(shareToken) await attestations.publicCreate('coll_123', { subjectType: 'proof', subjectId: 'proof_1', attestationType: 'photo', value: { url }, visibility: 'public', guestName: 'Sam', }) ```
+
+**moderate**(collectionId: string,
+    attestationId: string,
+    input: ModerateAttestationInput) → `Promise<ModerateAttestationResponse>`
+Moderate a contributed attestation (proof OWNER by identity, or collection admin). `'approve'` releases it to its declared visibility; `'reject'` keeps it author + admin only. Only the `moderationStatus` changes — the hashed fact and its chain are untouched. Find pending items with {@link publicList} + `moderationStatus: 'pending'`. POST /public/collection/:collectionId/attestations/:attestationId/moderate ```ts await attestations.moderate('coll_123', 'att_uuid', { decision: 'approve' }) ```
+
 **publicSummary**(collectionId: string,
     params: AttestationSummaryParams) → `Promise<PublicAttestationSummaryResponse>`
 Time-series summary (public). Always served at `audience='public'`.  Same parameters as the admin version. `attestationType` are required

package/dist/docs/attestations.md

@@ -159,6 +159,34 @@ The middleware resolves the UID and checks ownership:
 
 When ownership is confirmed the request is served at `audience='owner'`, which includes `ownerData`.
 
+**Owner write** — the proof owner may also *author* an attestation on their own item via `POST /api/v1/public/collection/:collectionId/attestations` (`attestations.publicCreate`). It is the public counterpart to the admin write, with tight guardrails:
+
+- the caller must be authenticated and **own the linked proof** (identity — a read grant is not enough); a subject with no linked proof is rejected;
+- they may write `value` and `ownerData` only — **`adminData` is dropped** (the business zone);
+- `visibility` is clamped to `'public' | 'owner'` (never `'admin'`), defaulting to `'owner'`;
+- `authorId` is forced to the caller and `metadata.authorType = 'owner'` is stamped.
+
+**Contribute write (grant)** — the same endpoint also accepts a holder of a
+`contribute`-scope share grant (set the token with `setGrantToken` first), so a
+third party can add an attestation without owning the proof. Named grant →
+attributed to the signed-in uid; public-link grant → anonymous, with `guestName`
+for attribution; `grantId` is stamped either way. If the grant was issued with
+`moderate: true`, the record is created with `moderationStatus: 'pending'` and is
+held to the owner until approved.
+
+**Moderation** — `moderationStatus` (`approved` | `pending` | `rejected`) is a gate
+**orthogonal to `visibility`** and excluded from the hash chain. A `pending` record
+is returned only to its author and to owner/admin audiences — never to the public,
+whatever its target visibility — and is excluded from public analytics. The owner
+(identity) or a collection admin resolves it with `attestations.moderate(collectionId,
+attestationId, { decision: 'approve' | 'reject' })`; approve releases it to its
+declared visibility, reject keeps it author+admin-only. The review queue is
+`attestations.publicList(..., { moderationStatus: 'pending' })`. Flipping the status
+leaves the hashed fact and its chain untouched. See
+[Proof Share Grants → Contribute access](proof-share-grants.md#contribute-access--let-someone-add-to-a-proof).
+
+The record joins the same append-only, hash-chained log as business/system writes. Business writes (any zone/visibility) remain admin-only.
+
 ### Visibility vs audience
 
 `visibility` is a property of an **individual record** set at write time.  `audience` describes the **caller's tier** resolved at read time.  The server applies:

package/dist/docs/proof-share-grants.md

@@ -22,11 +22,12 @@ re-checks the grant **server-side** against the database, so revocation is immed
 |-------|--------------------|
 | `read` | read owner-tier data on the proof (attestations, threads, records, cases) |
 | `comment` | create threads/replies on the proof (guest comments) |
+| `contribute` | add attestations / records to the proof for the life of the grant (temporary contribute access) — optionally held for owner review via `moderate` |
 | `admin` | read owner-tier data (reserved for elevated share cases; never exposes the platform admin zone) |
 | `verify_owner` | redeem a shareable ownership **assertion** (not the account) |
 
 A grant can carry several scopes, e.g. `['read', 'comment']` for a shareable,
-commentable album.
+commentable album, or `['read', 'contribute']` to let someone add photos.
 
 ### Security & lifecycle
 
@@ -124,6 +125,65 @@ Other grant holders (and the owner) see these comments because a `read` grant re
 
 ---
 
+## Contribute access — let someone add to a proof
+
+A `contribute` scope grant is **temporary write access**: the bearer can add
+attestations (a photo, a video reference, a check-in) and app records to the proof
+for the life of the grant — no account or proof claim required. It's the successor
+to ad-hoc "claim windows": properly time-boxed (`expiresAt`), revocable, and voided
+on ownership transfer like every other grant.
+
+```typescript
+// Owner issues a contribute grant that expires in 48h and holds contributions
+// for review before they go public.
+const grant = await proof.createGrant(collectionId, productId, proofId, {
+  scope: ['read', 'contribute'],
+  moderate: true,                                   // contributions land 'pending'
+  expiresAt: new Date(Date.now() + 48 * 60 * 60 * 1000),
+})
+
+// Contributor (on the shared link) adds a photo attestation.
+setGrantToken(shareToken)
+await attestation.publicCreate(collectionId, {
+  subjectType: 'proof', subjectId: proofId,
+  attestationType: 'photo',
+  value: { url: 'https://…/photo.jpg' },
+  visibility: 'public',
+  guestName: 'Sam',                                 // attribution for a public-link bearer
+})
+```
+
+### Moderation — the two-step review
+
+When the grant is issued with `moderate: true`, each contribution is created with
+`moderationStatus: 'pending'` and is **held to the owner**: it is returned only to
+its own author and to owner/admin audiences — never to the public, whatever its
+target `visibility`. The owner reviews and approves (or rejects) it:
+
+```typescript
+// Owner lists what's waiting (owner-tier read = identity or an owner session):
+const { attestations } = await attestation.publicList(collectionId, {
+  subjectType: 'proof', subjectId: proofId,
+  moderationStatus: 'pending',
+})
+
+// Approve → the record goes live at its declared visibility; reject → author+admin only.
+await attestation.moderate(collectionId, attestations[0].id, { decision: 'approve' })
+```
+
+The moderation gate is enforced **server-side** — a front end may badge a pending
+item, but it is the server that withholds it from other viewers. Only
+`moderationStatus` changes on approve/reject; the hashed fact and its chain are
+untouched. Contributions under a grant issued with `moderate: false` (the default)
+go live immediately.
+
+> **Media note.** A contributed photo/video is best modelled as an attestation
+> (`attestationType: 'photo'`, `value: { url }`) so it rides this moderation model.
+> The legacy per-proof asset upload path is unchanged and is not grant- or
+> moderation-aware.
+
+---
+
 ## Proof of ownership — `verify_owner`
 
 Ownership itself is **not** a grant — it is `proof.ownerId`, established via the
@@ -154,6 +214,7 @@ granted proof (and only that proof):
 - **Attestations** — `attestation.publicList({ subjectType: 'proof', subjectId })`
 - **Threads / Records / Cases** — `app.threads.list`, `app.records.*`, `app.cases.list`, and the single-item GETs, filtered to the granted proof
 - **Thread creation / replies** — with a `comment` scope grant (see below)
+- **Attestation / record creation** — with a `contribute` scope grant (see [Contribute access](#contribute-access--let-someone-add-to-a-proof))
 
 The token never exposes the platform `admin` zone, and only reveals `owner`-visibility
 rows for the granted `proofId`.
@@ -175,14 +236,24 @@ at `sites/{collectionId}/apps/{appId}` — a `grant` branch alongside
         "requireScope": "comment",
         "enforce": { "visibility": "owner", "status": "open" }
       }
+    },
+    "records": {
+      "grant": {
+        "allow": true,
+        "requireScope": "contribute",
+        "enforce": { "visibility": "owner" }   // held to the owner until promoted
+      }
     }
   }
 }
 ```
 
-This enables grant-scoped commenting **without** opening up anonymous creation. The
-`enforce.visibility: "owner"` keeps comments private to the proof (visible to the
-owner and other grant holders, not the wider public).
+This enables grant-scoped commenting and contribution **without** opening up
+anonymous creation. The `enforce.visibility: "owner"` keeps the created object
+private to the proof (visible to the owner and other grant holders, not the wider
+public). Attestation contribution is gated the same way, by the `contribute` scope;
+whether those contributions are held for review is set per-grant with `moderate`,
+not in app config.
 
 ---
 
@@ -200,12 +271,13 @@ namespace proof {
 function setGrantToken(token: string | undefined): void
 function getGrantToken(): string | undefined
 
-type GrantScope = 'read' | 'comment' | 'admin' | 'verify_owner'
+type GrantScope = 'read' | 'comment' | 'contribute' | 'admin' | 'verify_owner'
 
 interface CreateGrantOptions {
   scope: GrantScope[]                                   // at least one
   audience?: { kind: 'public_link' } | { kind: 'named'; email?: string; userId?: string }
   expiresAt?: Date | string
+  moderate?: boolean                                    // 'contribute' only — hold for review
 }
 
 interface RedeemGrantOptions { guestName?: string }
@@ -219,6 +291,7 @@ interface ProofGrant {
   proofId: string
   productId?: string | null
   scope: GrantScope[]
+  moderate?: boolean   // 'contribute' grants: contributions held for review when true
   audience: { kind: 'public_link' | 'named'; email?: string; userId?: string }
   createdBy: string
   expiresAt?: string | null